Privacy Safe Family Profiles: History, Law and Codes

Two strands of rules shape privacy safe family profiles history, and they were built by different hands. Both apply to a family profile, and each strand names the specific harm it was written to prevent. One is law: the UK Data Protection Act 2018 and the UK GDPR alongside it, the EU GDPR and its Article 8 on a child's consent, the US Children's Online Privacy Protection Rule, and the ICO's Age Appropriate Design Code, together with the court decisions that made private life a claim a person can bring. The other is self-regulation, written by publishers for publishers: the Editors' Code of Practice, the IMPRESS Standards Code, and the codes of the Associated Press, the Society of Professional Journalists and the National Press Photographers Association.

A family profile here means a published account of a family: a couple, their children, a birth, a school run, a photograph taken in the street. The details are usually gathered from public records and public places, which is why the line between public and private does so much work in the rules below. A birth announcement or a first-day-of-school picture is a family profile, and each of those has drawn a rule.

What to take away

The two strands, kept apart

Law arrived through data protection and through court decisions about private life. It asks what a person's information is, who may process it, on what basis, and what the person can require afterwards. A fact stays something a person has an interest in even after disclosure.

Those decisions have names worth knowing. Campbell v MGN (2004) established that publishing private information can be a wrong in itself, apart from breach of confidence. Von Hannover v Germany (2004) held that a public figure's family life is protected even when the photographs were taken in a public place. Murray v Big Pictures (2008) and Weller v Associated Newspapers (2015) carried that reasoning to the children of famous parents, on the street and in the shopping aisle.

Self-regulation arrived through publishers writing codes for themselves. Those codes are often sharper than the law on this subject, because the people who drafted them knew the specific practices they wanted stopped.

A short chronology

The European Data Protection Directive 95/46/EC, adopted in 1995, preceded the UK's Data Protection Act 1998. The EU adopted the GDPR in 2016, and it applied from 2018; the Data Protection Act 2018 supplemented it in the UK. After the Brexit transition, the domestic UK GDPR applied from 2021.

COPPA became law in 1998, and the Federal Trade Commission's implementing rule took effect in 2000. The Editors' Code dates to 1991. The ICO's Age Appropriate Design Code was published in 2020, with its transition period ending in 2021.

The instruments, by name

Four named instruments do most of the work, and each answers a different question.

The Convention on the Rights of the Child is the only one of the four that states the right itself rather than the procedure around it. Article 8 protects a child's identity, including name and family relations. Article 16 protects against arbitrary interference with privacy and family.

That pairing is why a child is not a minor case of an adult. Identity and privacy are named as the child's own interests, not as interests held on the child's behalf by a parent. What follows for a page is set out in the guide to why the strictest rule falls on children.

What is law, and what is only guidance

Guidance is not the law. In the UK the binding text is the Data Protection Act 2018 and the UK GDPR alongside it, with the Information Commissioner's Office as the regulator. The ICO's Age Appropriate Design Code is a statutory code of practice under that Act, not advice.

The Children's Code standards

The ICO Children's Code sets out 15 standards for online services likely to be accessed by children: best interests of the child, data protection impact assessments, age-appropriate application, transparency, detrimental use of data, policies and community standards, default settings, data minimization, data sharing, geolocation, parental controls, profiling, nudge techniques, connected toys and devices, and online tools. These standards guide services' design and data processing; they are not a checklist of permission to publish a family story.

In the EU the GDPR applies directly, and its Article 8 governs a child's consent to an information society service offered directly to the child when consent is the processing basis. The default digital-consent age is 16, but each member state may set a lower age, not below 13. In the US the binding federal text is COPPA, enforced by the Federal Trade Commission. The Convention on the Rights of the Child binds only the states that ratify it, and the United States has not.

Where the law reaches, and where it stops

Data protection reframed the question. Instead of asking whether a statement was defamatory, it asked what may be done with a person's information and what the person can require afterwards.

Regulators then added conditions for categories where the subject cannot exercise those rights alone. The ICO's published guidance on handling information about children is the clearest working statement of what that means.

A separate development happened in services rather than publishers. The Children's Online Privacy Protection Rule, enforced by the Federal Trade Commission, applies to covered services collecting personal information from children under 13. It generally requires verifiable parental consent before collecting, using, or disclosing that information, subject to exceptions. It governs collection by services, not editorial judgment about what appears in print.

Both instruments leave the same principle standing: a child's information is not the parent's to trade away. The details vary by jurisdiction and change over time, so confirm the current text with the regulator that issues it.

Who enforces what

In the UK the Information Commissioner's Office enforces the Data Protection Act 2018 and the UK GDPR, with powers that include enforcement notices and fines. In the US the Federal Trade Commission enforces COPPA through civil penalties, while state attorneys general act under their own consumer privacy laws. California's rule comes from the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA): businesses generally need opt-in authorization to sell or share personal information about consumers under 16, with a parent or guardian providing it for children under 13. The state's Age-Appropriate Design Code Act has been challenged in court, which is a reminder that a statute on the books is not the same as a rule in force.

The press codes are enforced by their own regulators rather than by the state. A correction or a reprimand is the usual outcome.

Where the codes do the work

The Editors' Code of Practice, used by British press self-regulation, dates to 1991 and is worth reading as both a historical and a working document. Its clauses on harassment, on approaching children, and on hospitals each name a practice that was common enough to need a rule. It is enforced by IPSO for the publishers that subscribe to it, while IMPRESS runs a separate Standards Code for the titles that choose that route instead. Neither is a statute, and a publisher outside both schemes is bound by neither.

The provision that matters most here says a parent's fame alone does not justify publishing details of a child's private life. That closes the argument the whole genre rested on.

Clause 6 of the code, on children, is the clearest case. It bars approaching or photographing a child at school without the school's permission. It also bars photographing or interviewing a child under 16 on a welfare subject without a parent's consent. Both rules name the routine they were written against: the school-gate wait for a well-known parent's child.

A family profile tested against the rules

Consider a profile limited to a publicly announced birth involving Prince William and Catherine. The announcement may support repeating the facts it disclosed, but it does not supply a public-interest reason to add private health details, a child's school, or routine locations. The Editors' Code says a parent's fame alone does not justify publishing a child's private life; each added detail needs its own editorial and legal justification.

News organizations publish their own sourcing and verification standards in the same spirit. The Associated Press news values and principles show the pattern: a specific failure, then a specific rule. The Society of Professional Journalists' Code of Ethics and the National Press Photographers Association's Code of Ethics do the same work in the US. Broadcasters face one further layer that is not optional: the Ofcom Broadcasting Code, which UK licensees must follow as a condition of holding their licenses.

Reading an old page against today's standard

Historical material is useful and dangerous in the same document.

The productive reading treats an old profile as evidence about the practice: what it asserted, what it felt no need to justify, which fields it printed without hesitation, whose consent it assumed. All of that can be analyzed without repeating a single identifying detail.

The unproductive reading treats it as a source. A private fact does not become citable by being old, and the person it concerns is often alive and has spent decades not being asked about it.

Where the archive is the object of study, the finding aids are excellent. Guides such as the Chronicling America research guide explain how to search a historical press run. A finding aid does not answer what may be carried forward; that judgment stays with the editor. The same caution runs through the guide to what a profile may carry.

What the split predicts

If each strand was written after a specific harm, then some practice that feels normal now will be named by a later code. That is not a reason to wait for the code.

The public interest test is narrower than it sounds. A private detail earns publication when it bears on how a public role is exercised, or on a decision readers can act on. It does not earn publication because there is a market for it.

Apply that test directly; the codes only approximate it. Its current form on this site appears in the guide to what a public role licenses and, for the strictest case, the guide to claims about children.

Common questions

If our jurisdiction has no such rule, does any of this apply?

The specific clause may not. The reasoning does, and a page is readable everywhere regardless of where it was written. That makes the strictest applicable standard the practical one.

Are the self-regulatory codes binding?

They bind the publishers who subscribe to them, through their own commitment rather than through law. That makes them weak as enforcement and useful as a statement of what experienced editors concluded.

Has anything become more permissive over time?

In effect, yes, though not by decision. Material now circulates with no editor in the chain, so rules written for publications reach a smaller share of what gets published. The standards got stricter and their coverage got thinner.

Why does the history matter if the current rule is what applies?

Because the current rule will not fit your case exactly. Knowing what it was written to prevent is the only reliable way to extend it. A rule applied without its purpose gets satisfied on the letter and defeated in substance.